Java: Add tests for ExecTainted

Author: joefarebrother

java/ql/test/query-tests/security/CWE-078/ExecRelative.expected

@@ -0,0 +1 @@
+| Test.java:50:46:50:49 | "ls" | Command with a relative path 'ls' is executed. |

java/ql/test/query-tests/security/CWE-078/ExecRelative.qlref

@@ -0,0 +1 @@
+Security/CWE/CWE-078/ExecRelative.ql

java/ql/test/query-tests/security/CWE-078/ExecTaintedLocal.expected

@@ -0,0 +1,27 @@
+edges
+| Test.java:6:35:6:44 | arg : String | Test.java:7:44:7:69 | ... + ... |
+| Test.java:6:35:6:44 | arg : String | Test.java:10:29:10:74 | new String[] |
+| Test.java:6:35:6:44 | arg : String | Test.java:18:29:18:31 | cmd |
+| Test.java:6:35:6:44 | arg : String | Test.java:24:29:24:32 | cmd1 |
+| Test.java:28:38:28:47 | arg : String | Test.java:29:44:29:64 | ... + ... |
+| Test.java:57:27:57:39 | args : String[] | Test.java:60:20:60:22 | arg : String |
+| Test.java:57:27:57:39 | args : String[] | Test.java:61:23:61:25 | arg : String |
+| Test.java:60:20:60:22 | arg : String | Test.java:6:35:6:44 | arg : String |
+| Test.java:61:23:61:25 | arg : String | Test.java:28:38:28:47 | arg : String |
+nodes
+| Test.java:6:35:6:44 | arg : String | semmle.label | arg : String |
+| Test.java:7:44:7:69 | ... + ... | semmle.label | ... + ... |
+| Test.java:10:29:10:74 | new String[] | semmle.label | new String[] |
+| Test.java:18:29:18:31 | cmd | semmle.label | cmd |
+| Test.java:24:29:24:32 | cmd1 | semmle.label | cmd1 |
+| Test.java:28:38:28:47 | arg : String | semmle.label | arg : String |
+| Test.java:29:44:29:64 | ... + ... | semmle.label | ... + ... |
+| Test.java:57:27:57:39 | args : String[] | semmle.label | args : String[] |
+| Test.java:60:20:60:22 | arg : String | semmle.label | arg : String |
+| Test.java:61:23:61:25 | arg : String | semmle.label | arg : String |
+#select
+| Test.java:7:44:7:69 | ... + ... | Test.java:57:27:57:39 | args : String[] | Test.java:7:44:7:69 | ... + ... | $@ flows to here and is used in a command. | Test.java:57:27:57:39 | args | User-provided value |
+| Test.java:10:29:10:74 | new String[] | Test.java:57:27:57:39 | args : String[] | Test.java:10:29:10:74 | new String[] | $@ flows to here and is used in a command. | Test.java:57:27:57:39 | args | User-provided value |
+| Test.java:18:29:18:31 | cmd | Test.java:57:27:57:39 | args : String[] | Test.java:18:29:18:31 | cmd | $@ flows to here and is used in a command. | Test.java:57:27:57:39 | args | User-provided value |
+| Test.java:24:29:24:32 | cmd1 | Test.java:57:27:57:39 | args : String[] | Test.java:24:29:24:32 | cmd1 | $@ flows to here and is used in a command. | Test.java:57:27:57:39 | args | User-provided value |
+| Test.java:29:44:29:64 | ... + ... | Test.java:57:27:57:39 | args : String[] | Test.java:29:44:29:64 | ... + ... | $@ flows to here and is used in a command. | Test.java:57:27:57:39 | args | User-provided value |

java/ql/test/query-tests/security/CWE-078/ExecTaintedLocal.qlref

@@ -0,0 +1 @@
+Security/CWE/CWE-078/ExecTaintedLocal.ql

java/ql/test/query-tests/security/CWE-078/ExecUnescaped.expected

@@ -0,0 +1,2 @@
+| Test.java:7:44:7:69 | ... + ... | Command line is built with string concatenation. |
+| Test.java:29:44:29:64 | ... + ... | Command line is built with string concatenation. |

java/ql/test/query-tests/security/CWE-078/ExecUnescaped.qlref

@@ -0,0 +1 @@
+Security/CWE/CWE-078/ExecUnescaped.ql

java/ql/test/query-tests/security/CWE-078/Test.java

@@ -0,0 +1,64 @@
+import java.lang.ProcessBuilder;
+import java.util.List;
+import java.util.ArrayList;
+
+class Test {
+  public static void shellCommand(String arg) {
+    ProcessBuilder pb = new ProcessBuilder("/bin/bash -c echo " + arg);
+    pb.start();
+
+    pb = new ProcessBuilder(new String[]{"/bin/bash", "-c", "echo " + arg});
+    pb.start();
+
+    List<String> cmd = new ArrayList<String>();
+    cmd.add("/bin/bash");
+    cmd.add("-c");
+    cmd.add("echo " + arg);
+
+    pb = new ProcessBuilder(cmd);
+    pb.start();
+
+    String[] cmd1 = new String[]{"/bin/bash", "-c", "<cmd>"};
+    cmd1[1] = "echo " + arg;
+
+    pb = new ProcessBuilder(cmd1);
+    pb.start();
+  }
+
+  public static void nonShellCommand(String arg) {
+    ProcessBuilder pb = new ProcessBuilder("./customTool " + arg);
+    pb.start();
+
+    pb = new ProcessBuilder(new String[]{"./customTool", arg});
+    pb.start();
+
+    List<String> cmd = new ArrayList<String>();
+    cmd.add("./customTool");
+    cmd.add(arg);
+
+    pb = new ProcessBuilder(cmd);
+    pb.start();
+
+    String[] cmd1 = new String[]{"./customTool", "<arg>"};
+    cmd1[1] = arg;
+
+    pb = new ProcessBuilder(cmd1);
+    pb.start();
+  }
+
+  public static void relativeCommand() {
+      ProcessBuilder pb = new ProcessBuilder("ls");
+      pb.start();
+
+      pb = new ProcessBuilder("/bin/ls");
+      pb.start();
+  }
+
+  public static void main(String[] args) {
+      String arg = args.length > 1 ? args[1] : "default";
+
+      shellCommand(arg);
+      nonShellCommand(arg);
+      relativeCommand();
+  }
+}